JBAS-1768 X-port XSS login form repairs

Cross-porting 472bd5ae1486fc0349581b02e666d0e8b8d5c143 to our custom
login form.

Signed-off-by: Bill Erickson <berickxx@gmail.com>

diff --git a/KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2 b/KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2
index 6bf2c6d..761c1b7 100644 (file)
--- a/KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2
+++ b/KCLS/openils/var/templates_kcls/opac/parts/login/form.tt2
@@ -132,7 +132,7 @@
                                         END;
                                         redirect = redirect  | replace('^http:', 'https:');
                                     %]
-                                    <input type='hidden' name='redirect_to' value='[% redirect %]'/>
+                                    <input type='hidden' name='redirect_to' value='[% redirect | html %]'/>
                                     <input type="checkbox" name="persist" id="login_persist" /><label for="login_persist"> [% l('Stay logged in?') %]</label>
                                 </div>
                                 <div style="padding-top:14px;">